Repository navigation
Upgrade bundled Expat to 2.7.2 (e.g. for the fix to CVE-2025-59375) #138998
Description
Bug report
Bug description:
Hi! 👋
Please upgrade bundled Expat to 2.7.2 (e.g. for the fix to CVE-2025-59375).
- GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_7_2
- Change log: https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes
The CPython issue for previous 2.7.1 was #131809 and the related merged main pull request was #132192, in case you want to have a look. (The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.)
Thanks in advance!
CPython versions tested on:
3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch
Operating systems tested on:
Linux, macOS, Windows, Other
Linked PRs
- gh-138998: Upgrade vendored expat to 2.7.2 #138999
- [3.14] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) #139024
- [3.13] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) #139025
- [3.12] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) #139026
- gh-138998: expat/refresh.sh: Fail if Step 3 is not completed #139049
- [3.10] gh-138998: Upgrade vendored expat to 2.7.2 (#138999) #139053
- [3.9] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) #139055
- [3.11] gh-138998: Upgrade vendored expat to 2.7.2 (#138999) #139056
Activity
24 remaining items
[3.12] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) (#139026)
picnixz commented on Oct 7, 2025
After an other discussion, it was decided that it was fine to backport 2.7.2 and keep the default values.
cc @ambv
[3.9] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) (GH-139055)
hartwork commented on Oct 7, 2025
@picnixz seems to be about 3.9. How about Expat 2.7.3? Will you backport or should I (later today)? I checked #139312 just now but don't see anything 3.9 yet.
hartwork commented on Oct 7, 2025
@picnixz update: Found the answer at #139312 (comment) myself now 👍